npm

package
v0.3.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 19, 2026 License: Apache-2.0 Imports: 18 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ExtractPackageName

func ExtractPackageName(path string) string

ExtractPackageName extracts the package name from a node_modules path. e.g., "node_modules/@scope/package" -> "@scope/package" e.g., "node_modules/package" -> "package" e.g., "node_modules/a/node_modules/b" -> "b"

func IsYarnBerry added in v0.3.2

func IsYarnBerry(data []byte) bool

IsYarnBerry says whether lock data is the berry format rather than the classic one.

func ParseIntegrity

func ParseIntegrity(integrity string) (algorithm string, hash []byte, err error)

ParseIntegrity parses an SRI integrity string and returns the algorithm and hash. e.g., "sha512-abc123..." -> ("sha512", []byte{...})

Types

type BerryPackage added in v0.3.2

type BerryPackage struct {
	Name    string
	Version string

	// WorkspacePath is the directory of a workspace entry, empty for a
	// fetched package.
	WorkspacePath string

	// Dependencies maps names to the protocol-carrying references the
	// entry requires.
	Dependencies map[string]string
}

BerryPackage is one resolved entry.

type Decomposer

type Decomposer struct{}

func New

func New() *Decomposer

func (*Decomposer) DefaultOptions

func (d *Decomposer) DefaultOptions() any

DefaultOptions returns the default options for the npm decomposer.

func (*Decomposer) Extract

func (d *Decomposer) Extract(opts *api.DecomposerOptions) (*sbom.NodeList, error)

Extract parses package.json and package-lock.json files and builds the complete dependency graph as a protobom NodeList.

func (*Decomposer) FindCodeBases

func (d *Decomposer) FindCodeBases(index *code.PathIndex) ([]string, error)

FindCodeBases locates JavaScript codebases by their lockfiles. Lockfiles vendored under node_modules belong to installed dependencies, not to the codebase, and are skipped.

func (*Decomposer) Requirements

func (d *Decomposer) Requirements(_ *api.DecomposerOptions) []api.Requirement

Requirements returns the requirements for the decomposer. No external binary required - uses pure Go implementation.

type DependencyTree

type DependencyTree struct {
	// contains filtered or unexported fields
}

DependencyTree builds a complete dependency graph from npm package files.

func NewDependencyTree

func NewDependencyTree(pkg *PackageJSON, lock *PackageLock) *DependencyTree

NewDependencyTree creates a new dependency tree from parsed npm package files.

func (*DependencyTree) Build

func (dt *DependencyTree) Build(opts *api.DecomposerOptions) (*sbom.NodeList, error)

Build constructs the complete dependency graph as a protobom NodeList.

func (*DependencyTree) GetDependencyCount

func (dt *DependencyTree) GetDependencyCount() int

GetDependencyCount returns the total number of dependencies.

func (*DependencyTree) GetDirectDependencyCount

func (dt *DependencyTree) GetDirectDependencyCount() int

GetDirectDependencyCount returns the number of direct dependencies.

func (*DependencyTree) ListDependencies

func (dt *DependencyTree) ListDependencies() []string

ListDependencies returns a sorted list of all dependencies for debugging/testing.

type DependencyType

type DependencyType int

DependencyType represents the type of dependency relationship.

const (
	DepTypeNormal DependencyType = iota
	DepTypeDev
	DepTypePeer
	DepTypeOptional
)

func (DependencyType) String

func (dt DependencyType) String() string

String returns a string representation of the dependency type.

type LockPackage

type LockPackage struct {
	Name                 string            `json:"name,omitempty"`
	Version              string            `json:"version"`
	Resolved             string            `json:"resolved,omitempty"`
	Integrity            string            `json:"integrity,omitempty"`
	License              string            `json:"license,omitempty"`
	Dev                  bool              `json:"dev,omitempty"`
	Optional             bool              `json:"optional,omitempty"`
	Peer                 bool              `json:"peer,omitempty"`
	DevOptional          bool              `json:"devOptional,omitempty"`
	Dependencies         map[string]string `json:"dependencies,omitempty"`
	OptionalDependencies map[string]string `json:"optionalDependencies,omitempty"`
	// contains filtered or unexported fields
}

LockPackage represents a package entry in package-lock.json.

type Options

type Options struct {
	// IncludeDevDependencies includes dev dependencies in the output.
	IncludeDevDependencies bool

	// IncludeOptionalDependencies includes optional dependencies in the output.
	IncludeOptionalDependencies bool

	// IncludePeerDependencies includes peer dependencies in the output.
	IncludePeerDependencies bool

	// IgnoreNodeModulesCodebases instructs the decomposer to ignore any codebases
	// in node_modules directories (package-lock files from pulled dependencies)
	IgnoreNodeModulesCodebases bool
}

Options configures the npm dependency extraction.

type PackageJSON

type PackageJSON struct {
	Name                 string            `json:"name"`
	Version              string            `json:"version"`
	Description          string            `json:"description,omitempty"`
	License              string            `json:"license,omitempty"`
	Homepage             string            `json:"homepage,omitempty"`
	Repository           *Repository       `json:"repository,omitempty"`
	Dependencies         map[string]string `json:"dependencies,omitempty"`
	DevDependencies      map[string]string `json:"devDependencies,omitempty"`
	PeerDependencies     map[string]string `json:"peerDependencies,omitempty"`
	OptionalDependencies map[string]string `json:"optionalDependencies,omitempty"`
}

PackageJSON represents the structure of a package.json file.

func ParsePackageJSON

func ParsePackageJSON(dir string) (*PackageJSON, error)

ParsePackageJSON parses a package.json file from the given directory.

func ParsePackageJSONData

func ParsePackageJSONData(data []byte) (*PackageJSON, error)

ParsePackageJSONData parses package.json content from bytes.

func (*PackageJSON) GetAllDependencyNames

func (pj *PackageJSON) GetAllDependencyNames() []string

GetAllDependencyNames returns all direct dependency names.

func (*PackageJSON) GetDirectDependencies

func (pj *PackageJSON) GetDirectDependencies() map[string]DependencyType

GetDirectDependencies returns a map of dependency names to their types.

type PackageKey

type PackageKey struct {
	Name    string
	Version string
}

PackageKey uniquely identifies a package by name and version.

func (PackageKey) String

func (pk PackageKey) String() string

type PackageLock

type PackageLock struct {
	Name            string                 `json:"name"`
	Version         string                 `json:"version"`
	LockfileVersion int                    `json:"lockfileVersion"`
	Requires        bool                   `json:"requires"`
	Packages        map[string]LockPackage `json:"packages"`
}

PackageLock represents the structure of a package-lock.json file (v3 format).

func ParsePackageLock

func ParsePackageLock(dir string) (*PackageLock, error)

ParsePackageLock parses a package-lock.json file from the given directory.

func ParsePackageLockData

func ParsePackageLockData(data []byte) (*PackageLock, error)

ParsePackageLockData parses package-lock.json content from bytes.

func (*PackageLock) BuildPackageIndex

func (pl *PackageLock) BuildPackageIndex() (byKey map[PackageKey]*LockPackage, byName map[string][]*LockPackage, byPath map[string]*LockPackage)

BuildPackageIndex creates indexes for quick package lookups.

func (*PackageLock) GetRootPackage

func (pl *PackageLock) GetRootPackage() *LockPackage

GetRootPackage returns the root package (the one at key "").

type PnpmImporter added in v0.3.2

type PnpmImporter struct {
	Dependencies         map[string]string
	DevDependencies      map[string]string
	OptionalDependencies map[string]string
}

PnpmImporter is one of the project's own packages, with its direct dependencies by kind. Values are version references: a resolved version, or link:<path> pointing at another importer.

type PnpmLock added in v0.3.2

type PnpmLock struct {
	// LockfileVersion is the schema version the file declared.
	LockfileVersion string

	// Importers are the project's own packages: "." for the project
	// itself, one more per workspace member, keyed by their directory.
	Importers map[string]*PnpmImporter

	// Packages are the resolved third-party packages, keyed name@version.
	Packages map[string]*PnpmPackage
}

PnpmLock is a parsed pnpm-lock.yaml, normalized.

func ParsePnpmLock added in v0.3.2

func ParsePnpmLock(data []byte) (*PnpmLock, error)

ParsePnpmLock reads a pnpm-lock.yaml document.

func ReadPnpmLock added in v0.3.2

func ReadPnpmLock(workDir string) (*PnpmLock, error)

ReadPnpmLock reads a pnpm-lock.yaml from a directory.

type PnpmPackage added in v0.3.2

type PnpmPackage struct {
	Name      string
	Version   string
	Integrity string
	Tarball   string

	// Dependencies and OptionalDependencies are the package's edges,
	// name to resolved version.
	Dependencies         map[string]string
	OptionalDependencies map[string]string
}

PnpmPackage is one resolved package.

type Repository

type Repository struct {
	Type string `json:"type"`
	URL  string `json:"url"`
}

Repository represents the repository field in package.json.

func (*Repository) UnmarshalJSON

func (r *Repository) UnmarshalJSON(data []byte) error

UnmarshalJSON handles both string and object forms of repository.

type YarnBerryLock added in v0.3.2

type YarnBerryLock struct {
	// Entries maps every selector to its resolution, edges resolving by
	// exact lookup as in the classic format.
	Entries map[string]*BerryPackage

	// Workspaces are the project's own packages, keyed by their directory.
	Workspaces map[string]*BerryPackage
}

YarnBerryLock is a parsed berry yarn.lock.

func ParseYarnBerryLock added in v0.3.2

func ParseYarnBerryLock(data []byte) (*YarnBerryLock, error)

ParseYarnBerryLock reads a berry yarn.lock document.

type YarnLock added in v0.3.2

type YarnLock struct {
	// Entries maps every selector — "name@range", one block may serve
	// several — to its resolution. Edges resolve through this map: a
	// dependency states a name and a range, and the pair is a selector.
	Entries map[string]*YarnPackage
}

YarnLock is a parsed classic yarn.lock.

func ParseYarnLock added in v0.3.2

func ParseYarnLock(data []byte) (*YarnLock, error)

ParseYarnLock reads a classic yarn.lock document.

func ReadYarnLock added in v0.3.2

func ReadYarnLock(workDir string) (*YarnLock, error)

ReadYarnLock reads a yarn.lock from a directory.

func (*YarnLock) Resolve added in v0.3.2

func (l *YarnLock) Resolve(name, rang string) *YarnPackage

Resolve finds the package a name and range pair selects.

type YarnPackage added in v0.3.2

type YarnPackage struct {
	Name      string
	Version   string
	Resolved  string
	Integrity string

	// Dependencies and OptionalDependencies map names to the ranges the
	// package requires, resolvable through the lock's selectors.
	Dependencies         map[string]string
	OptionalDependencies map[string]string
}

YarnPackage is one resolved package.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL